Executive brief
RabbitMQ is a message broker used to handle asynchronous communication between applications. An authenticated user can craft specially designed message filters on stream queues to cause excessive CPU usage through regex pattern backtracking. By publishing messages with long property values and applying a malicious filter pattern, an attacker can consume significant CPU resources—potentially across multiple sessions—degrading broker performance and availability for legitimate users.
Technical details
The vulnerability exists in RabbitMQ's pattern_to_regex function which converts SQL LIKE patterns (% and _) into Erlang regex patterns with overlapping lazy quantifiers. A crafted LIKE string with repeated %_ pairs generates a regex with exponential backtracking behavior (e.g., ^.*?..*?.....*?.X$). When re:run is called per-message without explicit match_limit restrictions, the default 10M match_limit caps processing at ~100-200 ms per message. An authenticated AMQP 1.0 consumer with read+write permissions on a stream queue can multiply this CPU cost across thousands of messages and parallel sessions, causing substantial CPU amplification.
Affected products
- RabbitMQ RabbitMQ Prior to 4.2.7 and 4.3.1
Timeline
- 2026-09-23: disclosed
- 2026-05-19: patched: Fixed in RabbitMQ 4.2.7
- 2026-05-20: patched: Fixed in RabbitMQ 4.3.1